CVE-2026-126817
Received
Received - Intake
Mongoid ODM Cleartext Storage Vulnerability
Vulnerability report for CVE-2026-126817, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-13
Last updated on: 2026-11-13
Assigner: MongoDB, Inc.
Description
Description
A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| MongoDB | Ruby Driver | 9.0.0 |
| MongoDB | Ruby Driver | 9.0.1 |
| MongoDB | Ruby Driver | 9.0.2 |
| MongoDB | Ruby Driver | 9.0.3 |
| MongoDB | Ruby Driver | 9.0.4 |
| MongoDB | Ruby Driver | 9.0.5 |
| MongoDB | Ruby Driver | 9.0.6 |
| MongoDB | Ruby Driver | 9.0.7 |
| MongoDB | Ruby Driver | 9.0.8 |
| MongoDB | Ruby Driver | 9.0.9 |
| MongoDB | Ruby Driver | 9.0.10 |
| MongoDB | Ruby Driver | 9.0.11 |
| MongoDB | Ruby Driver | 9.0.12 |
| MongoDB | Ruby Driver | 9.1.0 |
| MongoDB | Ruby Driver | 9.1.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
